<html>
<head>
<script>
    top.docRef = parent.document;  // access parent's DOM tree: should not be allowed
</script>
</head>
</html>
